|
 |
dissabte, 15 / gener / 2005 |
[InfoWorld] Experts warn of trick to bypass IE download warning. Una nova vulnerabilitat a l'Internet Explorer: només visitant una pàgina web es pot descarregar un fitxer, sense que l'usuari en tingui constància.
According to the Bugtraq message and Symantec alert, an IE feature designed to catch references to file downloads does not detect a particular HTML event, known as "onclick," when it is combined with the common HTML tag, which designates the beginning and ending of the main part of a Web page.
Malicious Internet users could use the onclick event in combination with another function called "createElement" to create an IFRAME, or "inline frame," which is an HTML element that allows external objects to be inserted into another HTML document. Attackers could link the IFRAME to a malicious Web page that downloaded a malicious file to the user's computer when the page was clicked on, without generating a warning in the Information bar, Symantec said.
There is no patch available for the new hole, and no specific exploit code is required to take advantage of the hole, Symantec said
|
18:08 (# Enllaç permanent) | Comentaris: | Trackback:
|
|
[SecurityFocus] FBI retires its Carnivore. El Carnivore ja no el fa servir ni l'FBI... això no vol dir que no espiin les xarxes, sinó que han canviat d'eines.
Developed by a contractor, Carnivore was a customizable packet sniffer that, in conjunction with other FBI tools, could capture e-mail messages, and reconstruct Web pages exactly as a surveillance target saw them while surfing the Web. FBI agents lugged it with them to ISPs that lacked their own spying capability.
(...)
FBI surveillance experts have put their once-controversial Carnivore Internet surveillance tool out to pasture, preferring instead to use commercial products to eavesdrop on network traffic, according to documents released Friday.
Two reports to Congress obtained by the Washington-based Electronic Privacy Information Center under the Freedom of Information Act reveal that the FBI didn't use Carnivore, or its rebranded version «DCS-1000», at all during the 2002 and 2003 fiscal years. Instead, the bureau turned to unnamed commercially-available products to conduct Internet surveillance thirteen times in criminal investigations in that period.
|
18:01 (# Enllaç permanent) | Comentaris: | Trackback:
|
|
[Tom's Hardware] A true mobile PC. Es tracta d'un dispositiu, de la mida d'un telèfon mòbil, anomenat Mobile Personal Server, que es connecta al port USB de qualsevol ordinador. Un cop connectat, aprofitant l'accés a Internet estableix una VPN amb un ordinador remot i passa a convertir-se en un potent ordinador amb dos processadors, 20 GB de disc dur i de totes les aplicacions que habitualment fem servir. És a dir, és una mena de terminal que ens permet utilitzar qualsevol ordinador, estigui on estigui, per accedir a les nostres aplicacions d'una forma segura. L'avantatge es que el podem dur a qualsevol lloc.
Això sí, amb una pega: els preus del servei.
|
14:42 (# Enllaç permanent) | Comentaris: | Trackback:
|
|
[SecurityFocus] A New Tool In The Spam War. Com el Projecte HoneyPot també és útil en la lluita contra el correu brossa. En concret es tracta de l'Anti-Spam Honeypot, un sistema que genera pàgines que contenen adreces de correu electrònic úniques. El Honeypot enregistra el moment en que es descarrega la pàgina així com l'adreça IP. En el cas de rebre SPAM a aquesta adreça, hem aconseguit identificar positivament el robot recol·lector d'adreces.
By identifying illicit harvesters, Project Honeypot opens up a new front in the war on spam. Webmasters can now identify and block robots that harvest email addresses from their websites. Indeed, because the Project collects participants' data and publishes a list of IP addresses associated with spam harvesters, webmasters and ISPs can block all the harvesting robots identified through Project Honeypot. Moreover, once harvesters have been identified, they can be prosecuted and sued under the CAN SPAM Act of 2004. And the states have their own anti-spam statutes, whose penalties as seen recently can be quite severe.
|
14:02 (# Enllaç permanent) | Comentaris: | Trackback:
|
|
© Copyright 2003-2005 Xavier Caballe.  . Si no s'indica expressament el contrari, el material publicat en aquest weblog es distribueix d'acord amb la llicència Creative Commons. El contingut és responsabilitat única i exclusivament del seu autor i no té cap relació amb les seves activitats professionals.
|
 |
 |
 |
 |
Contingut actualitzat
Categories
Darrers comentaris
Arxiu
Contingut antic
(ja no s'actualitza)
Versions anteriors
d'aquesta pàgina
|
 |
 |
 |
 |
|
